Federal budget: masters of our destiny, software updates sold separately

Thursday’s federal budget has “Masters of our destiny” on the cover. Its fifth chapter puts core defence spending at $75.1 billion this fiscal year and $99.2 billion by 2030-31, about $451 billion over the five years on a cash basis.¹ The big purchases run through the Defence Investment Agency,² and Bill C-40 would make the agency a Crown corporation. The House defence committee opened its study of that bill the morning the budget came out.³

We went through the bill and the chapter looking for the word software, and it’s not in either one.⁴ That would be a nitpick if the government hadn’t already written down why it matters. Back in February, the Defence Industrial Strategy said control by “foreign governments and their national defence contractors” can “lead to restrictions on the end-user having access to the needed IP, schematics and software updates to operate and sustain these platforms”. “Procurement decisions by the DIA will include steps to mitigate these risks to sovereign control,” it goes on.⁵

A bill that sets up a buyer and a budget that pays for one usually leave that level of detail to regulations and contracts, so that’s where those steps have to turn up. We haven’t found anything yet that says what they’ll look like.⁶

Filed under Buy

The strategy’s line about software updates sits under Buy, the last option in its Build-Partner-Buy framework, for when Canada turns to “direct acquisitions from foreign suppliers”. That passage is the only place the word software appears in the whole document.⁵

IP and schematics change slowly enough that you can negotiate for them up front and lock them in a safe. Updates keep coming for as long as the platform’s in service, and the agency’s files already include the Canadian Patrol Submarine, which the budget calls the largest defence procurement in Canada’s history.¹ Whoever signs for those boats will have retired long before the last patch goes on.

The same thing can happen under Build, if a platform assembled in Canada has a flight controller or radio firmware sitting on a toolchain somebody else controls. On gaps like AI and semiconductors, the Prime Minister told the European Parliament in September, countries end up relying on “individual nations or companies”, and “This creates vulnerabilities, particularly when supposedly ‘global’ companies prove national in the breach.”⁷

Nitrocellulose and drones

The budget’s defence industry section directs up to $2.7 billion over five years, from previously announced funding, toward quantum, space launch, an extension of BOREALIS and critical inputs. Those inputs are a nitrocellulose plant in Québec and high-grade ballistic steel, “reducing dependency on foreign suppliers”.¹ Both are real chokepoints, and the focus matches the strategy’s supply chain pillar, where a new program starts with ammunition and explosives.⁵

Software turns up nine times elsewhere in the budget, mostly in lists of what businesses invest in, plus a few tax definitions. The nearest it gets to defence is the Productivity Mega Deduction, which counts software among the assets firms can write off, and which Chapter 5 says will help firms “across Canada’s defence supply chain”. Chapter 5 names cyber in one funding line, $12 million over four years through Public Safety for the Canadian Cyber Defence Collective’s Strategic Forum.¹ Last year’s budget did set aside $10.9 billion over five years for digital infrastructure at National Defence, the CAF and the Communications Security Establishment, “including those needed for modern warfare, such as cyber defence”.² That money’s for infrastructure they run, and a platform’s update channel usually starts in somebody else’s shop.

Drones are where we’d look first. The budget proposes $2.3 billion over five years for the Defence Drone Initiative, meant to ensure “the reliable, rapid, and continuous supply of this sovereign capability” from a pool of nearly 400 Canadian suppliers it calls trusted. We’d read continuous supply of a drone to include its flight software, and a trusted Canadian supplier can still ship an autopilot built on libraries it doesn’t control. The budget says the first contract under the initiative was awarded in 50 days, so some of these terms already exist.¹ We haven’t seen them, and they may well cover updates.

What the bill would do

C-40 reaches further than a word search suggests. It would stretch defence supplies to cover “data or intangible or incorporeal property”, so software’s in scope whether or not anyone names it. Under section 13 the minister could require “any information” about defence supplies a person holds or has contracted for, “as well as the sources of supply for them”. Cabinet could designate “anything” for the government or the new corporation to stockpile under section 15, and as we read it that’s broad enough to cover a copy of a release. Section 29 would let the minister keep a bidder out on reasonable grounds that “anything proposed to be used in the performance of the contract poses a risk to national defence, national security or public safety”, with no reasons owed.⁴

Section 29 looks at what’s proposed when the bid comes in, and a software-dependent platform takes in new code for decades after award. Say a library it depends on changes hands in year twelve, or the company signing its updates gets bought. Unless there’s a new competition, section 29 doesn’t come into it. Section 15 could put this year’s release in a vault, the way nitrocellulose goes in a bunker, but nobody’s worked out how to stockpile a patch that hasn’t been written. Section 13 is the closest fit, since the minister could ask who’s supplying what at any point. What comes back is the supplier’s own account of its chain, and checking that account is something a contract or a regulation has to set up.

The one we’d watch is section 33. It would let cabinet make regulations “fixing terms that are deemed to be expressly set out in contracts, or classes of contracts”, so an update clause could arrive without anyone negotiating it. That’s for contracts under that part of the Act. The bill’s list of provisions that apply to the new corporation leaves section 33 out, so we’re less sure how far it reaches into the agency’s own buying.⁴

A sustainment clause

So what would “steps to mitigate” look like in a sustainment clause? For software, we’d start with terms a buyer can write down and check for itself.

Updates get delivered to the operator and held there, so if the supply stops the platform can stay on the last good one, as long as nothing in it needs a licence server to start. Each update carries provenance tied to the artifact, which the operator checks offline inside its own boundary with no help from the supplier. That provenance should come from a build platform the supplier doesn’t control, since a compelled supplier’s own signature verifies just fine. What got installed, where and when stays on record with the operator, where an assessor can read it, and the supplier has to tell the buyer when a dependency or a signing key changes hands, so somebody can ask section 29’s question again after award.

The buyer also holds enough to rebuild a release and compare it to what shipped, which usually means source under escrow or custody plus the build instructions. This is the expensive one, and it’s the one check that doesn’t lean on anybody else’s build platform. It needs a build that comes out the same twice, which a lot of software still doesn’t do, plus somebody who actually does the rebuild. Neither check helps with a backdoor written into the source itself, which builds clean and takes someone reading the source to find.

A bad update can still ship under all of these terms and verify clean. What the operator gets is a say over when it goes in, and a record of where it went once someone finds out.

Before the contracts

The committee wants written briefs on the bill by noon on November 18.³ The agency isn’t waiting on it. The budget says it’s already advancing the submarines and the Arctic Over-the-Horizon Radar.¹

If you supply a software-heavy platform, you can have this ready before anyone asks. Write down every software component the platform needs to keep running and who ships its updates from where, then mark the ones the buyer could check and rebuild without asking you. It’s the same list the last note asked SAFE bidders to write, with a column for updates.

Northfleet is a Canadian-incorporated vendor building the sovereign supply chain that wraps a customer-operated classified cluster: a deploy-time bundle protocol, attestation chain, and tamper-evident audit trail. The customer’s cleared engineering teams operate the cluster under their own keys. Northfleet holds no customer data and no customer signing keys. Every release Northfleet ships carries provenance binding it to the source it was built from, which the customer can check without Northfleet’s participation. The architecture assumes the vendor can be compromised or compelled, so compelling Northfleet doesn’t produce a silent backdoor, though catching one depends on someone actually checking releases against their source.

If you’re pricing sustainment on software-heavy kit, and part of what you deliver runs on Kubernetes inside a classified boundary, talk to us.